wnmsadcheck32.exe

[Martin]

Has anyone had any experience with this program
"wnmsadcheck32.exe"
it recently started running in the background on my machine (ME) and is
always present in the task list unless I deliberately "end task"
It occasionally throws out the following window at random (see jpg link for
image)
http://www.bloomfield.myby.co.uk/crap.jpg

I cannot seem to get rid of the program and it does not look to be a genuine
security program.
I cannot find much about it with google.

Thanks
Martin

[Mike M]

Martin,

wnmsadcheck32 is not part of the Win Me operating system which contains no
Windows Firewall. I would therefore be most suspicious and make a thorough
check of your system for unwanted malware. Unfortunately I can only find
one other reference on the net to a user having similar problems and that
is in German dated 20 Dec 2004.

When did you last check your system for malware using your preferred
antivirus application making sure first that you are using an updated
current set of viral reference signatures?

This might also be a good time to download yourself a copy of the free
Ad-Aware SE Personal edition from Lavasoft
(http://www.lavasoftusa.com/software/adaware/) and also SpyBot Search &
Destroy 1.3 (http://www.safer-networking.org/) and use them to check your
system for other commercial parasites remembering that they are only as
good as when you last updated their reference files. I also use a program
called BHODemon (http://www.definitivesolutions.com/bhodemon.htm that
checks for unwanted Browser Help Objects and SpywareBlaster
(http://www.wilderssecurity.net/spywareblaster.html) which can help
prevent some parasites getting a grip on your PC.

Just is case the problem is due to a new version of the CoolWebSearch
parasite you might want to download and run the CWShredder which targets
that specific parasite. Unfortunately neither AdAware or SpyBot seem to be
able as yet to fully detect all the various versions of the CoolWebSearch
parasite as it keeps changing. The latest version of CWShredder can be
downloaded (free) from
http://www.intermute.com/spysubtract/cwshredder_download.html

Finally if you still continue to experience problems download a copy of
HijackThis from (http://www.spywareinfo.com/~merijn/downloads.html).
Create a folder called HJT on C: (not on your desktop nor in your temp
folder) and copy the file you downloaded to that folder. Close as many
applications as you can including all instances of Internet Explorer.
Enable Explorer to see all files and folders (Tools | Folder Options |
View and check "Show hidden files and folders" and uncheck "Hide protected
operating system files") and then run hijackthis.exe and post back the log
to either the HijackThis Forum at http://forums.spywareinfo.com/ or
alternatively http://forum.aumha.org/viewforum.php?f=30 and hopefully this
will enable someone to identify the cause of your problem.

See also: Dealing with Unwanted Malware, Parasites, Toolbars and Search
Engines http://mvps.org/winhelp2002/unwanted.htm and also Browser
Hijacking http://www.spywareinfo.com/articles/hijacked/
--
Mike Maltby MS-MVP



Martin > wrote:

> Has anyone had any experience with this program
> "wnmsadcheck32.exe"
> it recently started running in the background on my machine (ME) and
> is always present in the task list unless I deliberately "end task"
> It occasionally throws out the following window at random (see jpg
> link for image)
> http://www.bloomfield.myby.co.uk/crap.jpg
>
> I cannot seem to get rid of the program and it does not look to be a
> genuine security program.
> I cannot find much about it with google.
>
> Thanks
> Martin

[Jack E Martinelli]

I would suspect any program whose name could be read as " MS Adcheck 32.exe"
and produced the page in your JPG, to be spyware.
If you can't rename it to "wnmsadcheck.jnk" in Windows, because it is
executing, boot to DOS mode and do so there.
And follow Mike M's advice.

If you can get a URL from the buttons in the JPG page, you may learn more
about it.
--
Jack E. Martinelli 2002-05 MS MVP for Shell/User / DTS
Help us help you: http://www.dts-L.org/goodpost.htm

http://www.microsoft.com/athome/security/protect/default.aspx
Your cooperation is very appreciated.
------
"Martin" > wrote in message
.. .
> Has anyone had any experience with this program
> "wnmsadcheck32.exe"
> it recently started running in the background on my machine (ME) and is
> always present in the task list unless I deliberately "end task"
> It occasionally throws out the following window at random (see jpg link
for
> image)
> http://www.bloomfield.myby.co.uk/crap.jpg
>
> I cannot seem to get rid of the program and it does not look to be a
genuine
> security program.
> I cannot find much about it with google.
>
> Thanks
> Martin
>